On a private cloud I am setting up, I have a a few RHEL VMs, networks, and a router on openstack. My router is connected to the public internet and my gateway node is connected to the router and has internet access through eth0. The node is connected to the internal network on eth1. I have a few internal RHEL nodes connected to the internal network on their eth0 interfaces. The nodes can all ping one another and I believe the ifcfg files for each node are set up correctly.

Using IPTables, I've tried to give the internal nodes internet access by:

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT  
iptables -A FORWARD -i eth0 -o eth1 -m conntrack -ctstate ESTABLISHED,RELATED -j ACCEPT  
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

I've also enabled ipv4 forwarding (disabled by default) on the kernel level. After saving the configuration and SSHing into an internal node, I cannot ping outside addresses:

# ping
connect: Network is unreachable

My router in openstack has a static route with
Destination CIDR: my internal network
Next Hop: my gateway node

Why can't I get internet access on my internal nodes? What am I missing here?


It could be that you have not enabled forwarding in the kernel -


echo 1 > /proc/sys/net/ipv4/forward

If that solves the problem, make it permanant by editing /etc/sysctl.conf and adding the line

net.ipv4.ip_forward = 1

Network is unreachable means there's no route defined to reach This is most likely a problem returned directly by the VM, and which is in the VM, not the host.

OpenStack has a lot of different possible network configurations. You just wrote "networks, " and didn't give any information on the VMs' IPs. Hoping there's no unknown setting (intermediate networks with intermediate NATs done), on each VM you need to add a default route via the IP set on your router's eth1 interface. if this IP was for example, then this would do it:

ip route add default via

For permanent settings, it should be added in its specific configuration file (see Static Routes and the Default Gateway from Redhat).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.